CVE-2024-49856 – A deadlock vulnerability in the Linux kernel's ... (How to Fix)

Q: What is the severity of CVE-2024-49856?

CVE-2024-49856 has a CVSS score of 5.5 (MEDIUM). A deadlock vulnerability in the Linux kernel's SGX (Software Guard Extensions) NUMA node search can cause soft lockups when the current CPU node lacks EPC memory sections. This affects systems with Intel SGX enabled and specific NUMA configurations, potentially leading to denial of service.

📋 TL;DR

A deadlock vulnerability in the Linux kernel's SGX (Software Guard Extensions) NUMA node search can cause soft lockups when the current CPU node lacks EPC memory sections. This affects systems with Intel SGX enabled and specific NUMA configurations, potentially leading to denial of service.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific kernel versions with the vulnerable SGX NUMA search code (exact range depends on backports)

Operating Systems: Linux distributions with Intel SGX support

Default Config Vulnerable: ✅ No

Notes: Only affects systems with Intel SGX enabled and NUMA architecture where some nodes lack EPC sections. Most consumer systems not affected.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

System becomes unresponsive due to soft lockup, requiring hard reboot and causing extended downtime.

🟠

Likely Case

Degraded performance or temporary system hangs when SGX operations are attempted on nodes without EPC sections.

🟢

If Mitigated

Minor performance impact during SGX operations if system has proper NUMA/SGX configuration.

🌐 Internet-Facing: LOW - Requires local access and specific SGX/NUMA configuration.

🏢 Internal Only: MEDIUM - Could affect servers with SGX enabled and improper NUMA configuration.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Requires local access, SGX enabled, specific NUMA configuration, and ability to trigger SGX operations on affected nodes.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits 0f89fb4042c08fd143bfc28af08bf6c8a0197eea or later

Vendor Advisory: https://git.kernel.org/stable/c/0f89fb4042c08fd143bfc28af08bf6c8a0197eea

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Check distribution-specific advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable SGX

linux

Completely disable Intel SGX if not required

Add 'nosgx' to kernel boot parameters in GRUB configuration

Configure EPC sections on all NUMA nodes

linux

Ensure each NUMA node has EPC memory sections configured

Requires BIOS/UEFI firmware configuration

🧯 If You Can't Patch

Disable SGX via kernel boot parameter 'nosgx'
Avoid SGX-intensive workloads on systems with mixed NUMA/SGX configurations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and SGX status: 'uname -r' and 'dmesg | grep -i sgx'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commit: 'uname -r' should match patched version

📡 Detection & Monitoring

Log Indicators:

Kernel soft lockup messages in dmesg
SGX-related errors in system logs

Network Indicators:

None - local vulnerability only

SIEM Query:

Search for 'soft lockup' or 'CPU stuck' messages in kernel logs

📊 Metadata

CVE ID: CVE-2024-49856

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-835

Published: October 21, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-49856, you might also want to check these: